Designed for defense, finance, healthcare, and engineering teams that refuse to compromise on privacy, cryptographic sovereignty, and compliance.
Notes and documents are stored encrypted in your local IndexedDB storage. Documents protected by Passkeys are decrypted purely client-side using WebCrypto APIs. TreeNote infrastructure never holds your master passkeys.
Data at rest uses AES-256 GCM cryptographic authenticated encryption. Cryptographic key derivation employs PBKDF2 with SHA-256 (600,000+ iterations) or Argon2id.
All web traffic and peer synchronization connections enforce TLS 1.3 with Perfect Forward Secrecy (PFS), modern cipher suites, and HSTS preloading.
Support for WebAuthn biometric passkeys (Touch ID, Face ID, YubiKey). Hardware-backed private keys ensure credential stuffing and phishing resistance.
Comprehensive operational controls mapped against SOC-2 Type II Trust Services Criteria (Security, Confidentiality, and Availability) and ISO/IEC 27001 guidelines.
Enterprise deployments can be provisioned in dedicated AWS Virtual Private Clouds (VPC) with AWS PrivateLink endpoints, preventing data traversal across the public internet.
How TreeNote delivers millisecond outliner latency while isolating corporate data inside secure boundaries.
Our scalable sync layer operates on Amazon Web Services (AWS) utilizing multi-AZ redundant serverless compute, AWS KMS for hardware root-of-trust encryption keys, and Amazon S3 with immutable Object Lock for compliance backups.
Enterprise customers can connect their corporate AWS environment directly to TreeNote sync clusters through AWS PrivateLink, ensuring that CRDT sync packets never touch the public internet.
Security researchers and enterprise compliance auditors can reach our dedicated Security Operations Center directly.